physiology
Saved on this device

Everything you keep stays in this browser. There is no account and no sign-in.

Saved ScenariosSettings

Embed & API

Embed versioned physiology models, or read the static JSON API.

Live Embed Preview

DraftThis pre-alpha documents a featherweight iframe contract and build-published JSON. The included sample (High-sugar meal) is an unreviewed draft and the production host artifacts are not published yet.
physiology

High-sugar meal — 6 hours

A representative healthy adult model. Move through time to see how the systems respond.

Glucosetypical range70–140mg/dLholding
Insulintypical range2–25µU/mLholding
Heart ratetypical range60–100bpmholding
Energysteadyholding

Typical ranges for a representative healthy adult model — not a measurement.

Time elapsed

00:00:00

Width: 600pxHeight: 520px

Embed with React

Copy and paste the code below to embed the physiology widget in your React app.

import { PhysiologyEmbed } from '@physiology/embed';

export function Example() {
  return (
    <PhysiologyEmbed
      baseUrl="https://your-physiology-host.example"
      eventId="high-sugar-meal"
      revision="0.1.0"
      timestamp={0}
      locale="en"
      theme="light"
      showControls={true}
      showMetrics={true}
      renderMode="diagram"
      width=600
      height={520}
      onTimeChange={(seconds) => console.log('time', seconds)}
    />
  );
}

Configuration

baseUrlRequired
https://your-physiology-host.exampleAbsolute HTTPS origin serving the /embed route.
eventIdRequired
high-sugar-mealThe ID of the event to embed.
revisionRequired
0.1.0Immutable semantic version; never latest.
timestampOptional
0Time in seconds, clamped to the event duration.
themeOptional
Options: light, dark, auto.
localeOptional
en or es.
renderModeOptional
diagram (recommended) or 3d.
showControlsOptional
Show timeline controls.
showMetricsOptional
Show key metrics panel.

dark and auto are accepted for forward compatibility; the design system has no dark mode, so v1 renders the light theme.

Available Events

View all events

Developer Tip

All times are in seconds, never milliseconds. Use the embed API to control playback, listen for time updates, and clamp to the duration published in the index.

Customize embed

These fields drive the live preview, the dimension readout, and every snippet on this page.

dark and auto are accepted for forward compatibility; the design system has no dark mode, so v1 renders the light theme.

Integration notes

Static JSON API

Public, read-only files generated with the site. There is no live query service and no secret key.

There is no runtime API backend. Embed pages and revision-pinned JSON are generated together; copied URLs are enabled only for entries present in the deployed index.

/api/v1/events/index.json
/api/v1/events/{id}@{rev}.json
/api/v1/events/{id}/frames/{rev}-step-{step}.json

Deployment contract Only use endpoints advertised by the deployed index. Arbitrary frame steps are not computed at request time on a static host.

Origin, permissions & privacy

  • No API key

    There is nothing to authenticate against. A one-time, data-free handshake transfers a private MessageChannel to the exact iframe Window; the child pins event.source and event.origin, and every command and event then stays on that port.

  • Permissions

    Allow fullscreen only when needed; deny camera, microphone, location, payment and sensors in both the iframe allow attribute and the host Permissions-Policy header.

  • Privacy

    The embed sends no referrer, stores nothing, and must not require cookies. The host page controls analytics and consent.

  • Framing

    The embed response may use frame-ancestors *; the rest of the site should retain a restrictive framing policy.

Hosting headers

Static JSON needs Access-Control-Allow-Origin: *. Versioned documents should be immutable; the mutable index should use a short cache.

Access-Control-Allow-Origin: *
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
Cache-Control: public, max-age=31536000, immutable

Self-hosting safe URLs preserve a deployment path prefix. Generate the embed route and API artifacts in the same static build so revisions cannot drift.

Protocol changelog

v1 · authenticated MessageChannel handshake; queued commands; ready, acknowledgement, constrained errors and explicit revocation.

Getting help

There is no staffed support desk. Open an issue in the repository, or read the specs under docs/ — they are the source of truth for these contracts.